[Zach Dunn (zachdunn)]

Requested by Zach · project thread

Why

Images dragged into PRs on private repos were never imported. GitHub only serves github.com/user-attachments/assets/<id> to users with repo access: a user token gets a 302 to S3, but the app's installation token gets a 404, which ingest records as a permanent asset_not_found skip. The production ledger has zero user-attachment rows for the private sunny-sdk/sunny repo, only Cursor artifacts. A manual uploads ingest --pr 3332 there skipped both images as asset_not_found.

The webhook path also threw the ingest summary away, so these skips never showed up in Worker logs.

What

• On a 403/404 for a user-attachments asset, fetch the source's rendered HTML (application/vnd.github.html+json, body_html). It carries a short-lived signed private-user-images.githubusercontent.com/...<uuid>...?jwt= URL for the same asset. Fetch that without auth. I checked this by hand on sunny-sdk/sunny#3332: the signed URL returns 200 image/png with no auth header.
• Log github ingest skipped attachments (repo, number, source, reasons) when a webhook ingest skips anything.

Public repos are unchanged: the direct fetch succeeds, so the fallback never runs.

Tests

• New test: a 404 on the attachment falls back to the signed URL from body_html, with & decoded and no auth header sent.
• The existing ingest suites pass (vitest run ingest: 54 tests), and so does pnpm typecheck.

---

Generated by Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: 73581c4

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one): 2

• coderabbit:review
• review

🚫 Excluded labels (none allowed): 1

• wip

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2043a975-b698-49f0-8150-2def0e5b651c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}